Modern extensible web platforms like Facebook and Yammer depend on third-party
software to offer a rich experience to their users. Unfortunately, users running a third-party …

Typical security contests focus on breaking or mitigating the impact of buggy systems. We
present the Build-it, Break-it, Fix-it (BIBIFI) contest, which aims to assess the ability to …

Many modern web-platforms are no longer written by a single entity, such as a company or
individual, but consist of a trusted core that can be extended by untrusted third-party authors …

We present the foundations for a new dynamic information flow control (IFC) parallel runtime
system, LIO _ PAR. To our knowledge, LIO _ PAR is the first dynamic language-level IFC …

Faceted execution is a linguistic paradigm for dynamic information-flow control with the
distinguishing feature that program values may be faceted. Such values represent multiple …

Faceted Execution is a linguistic paradigm for dynamic information-flow control. Under
faceted execution, secure program data is represented by faceted values: decision trees that …

There is currently little evidence about what tools, methods, processes, and languages lead
to secure software. We present the experimental design of the Build it Break it secure …

Enforcing the confidentiality and integrity of information is critical in distributed applications.
Production systems typically use some form of authorization mechanism to protect …

Abstract Information Flow Control (IFC) is a principled approach to protecting the
confidentiality and integrity of data in software systems. Intuitively, IFC systems associate …

Developing correct and secure software is an important task that impacts many areas
including finance, transportation, health, and defense. In order to develop secure programs …